Eighty-eight days
It ended this week.
Iran restored global internet access starting around 11:00 UTC on Tuesday, May 26, 2026. By NetBlocks' count it was Day 88 of the shutdown that intensified after the February 28 strikes — the longest nationwide internet shutdown in modern history. President Masoud Pezeshkian gave the order May 25; the Supreme Council of Cyberspace task force approved restoration over hardliner objection. Roughly 90 million people had been cut off. The shutdown-period economic cost is estimated at approximately $1.8 billion.
There is a humane way to read this, and it is the correct first reading: a population of 90 million is being reconnected to the world after three months in the dark, and that is good. Iranians are back online — talking to family abroad, reaching news, doing business. Cloudflare Radar caught the moment: a marked increase in both traffic and DNS queries beginning May 26.
Then the breakpoint.
At its peak on May 26, Cloudflare measured traffic returning to only about 40 percent of the maximum activity observed so far in 2026. The "filternet" — Iran's censorship layer — remained fully active through the restoration. WhatsApp, YouTube, and Instagram are still blocked or heavily restricted. VPNs are still required to reach what the filternet blocks. CNN's dispatch carried the mood: Iranians "emerge online with skepticism and defiance."
And underneath the restoration sits an architectural fact that reframes the entire 88 days. A member of Iran's Supreme Council of Cyberspace, Mohammad Sarafraz, disclosed in May — per RFE/RL reporting — that Iran imported Chinese Deep Packet Inspection hardware intended for the permanent blocking of the global internet for ordinary users, allowing only tightly monitored access for select users.
The shutdown was not only an emergency. It was the construction-and-demonstration phase of a permanent architecture.
The off-switch was proven to work for 88 days. The Chinese hardware makes the throttle permanent. The blackout ending does not undo the architecture.
The architecture was the point.
Forty percent
The hardest number in the restoration is 40 percent.
That is the peak — at its highest on May 26, per Cloudflare Radar, Iranian internet traffic reached only about 40 percent of the 2026 maximum. The figure will move; a peak measurement is not a fixed permanent baseline, and connectivity may climb further in the days after this is published. But the volume is not the point. The shape is the point.
Through the entire restoration, the filternet stayed fully active. The same blocking that defined the blackout defines the restoration; the difference is the volume of traffic flowing through the filter, not the existence of the filter. WhatsApp, YouTube, Instagram — still blocked. VPN — still required. The restored internet is the filtered internet, at higher throughput.
The class-based access tiers built during the blackout remain as standing infrastructure. The "white SIM" tier and the costly "Internet Pro" tier — where approved IRGC- and MCI-affiliated professionals receive whitelisted bandwidth at roughly €0.20 per gigabyte while the general public pays approximately €75 per month for commercial VPN access, a roughly 12.5× differential — were not dismantled with restoration. They were demonstrated, normalized, and kept. The Quincy Institute called the system "digital apartheid" in a May 12 analysis. The tiers outlived the blackout.
This is the structural reading of the restoration: the blackout ending does not undo the architecture it built. The 88 days were the period during which the off-switch was tested at national scale, the access tiers were stood up, and the Chinese hardware was put in place. The restoration is the system coming online — not the system being dismantled.
The volume number will rise. The shape of access — controlled, tiered, DPI-mediated — is the new baseline.
The permanent throttle
Deep Packet Inspection is the mechanism that turns a blackout into a throttle.
A blackout is a blunt instrument: connectivity drops to 4 percent of normal, as NetBlocks measured in Iran, and everyone is cut off equally. It is economically catastrophic — the $1.8 billion shutdown cost is the measure of how catastrophic — and politically expensive, because cutting off 90 million people produces 90 million grievances. A blackout cannot be sustained indefinitely. That is why this one ended at 88 days.
DPI is the precision instrument. Instead of cutting the line, it inspects every packet at the network layer and decides — per connection, per protocol, per destination — what passes. It is the mechanism of China's Great Firewall: the ability to identify and block encrypted traffic without dropping the whole network. It lets a state keep the internet "on" at 40 percent while permanently blocking what it chooses, indefinitely, at far lower economic and political cost than a blackout.
Sarafraz's disclosure — attributed to a named member of the Supreme Council of Cyberspace, reported by RFE/RL — is that Iran imported Chinese DPI hardware for exactly this purpose: the permanent blocking of the global internet for ordinary users, with tightly monitored access for select users. "Permanent" here is disclosed intent, not yet an operational steady state; "already in place," per TechTimes' reporting, is the hardware status. The distinction matters. What is demonstrated is the capacity and the intent. What is built is the hardware.
This is what Iran's National Information Network has been moving toward for years: full separation from the global internet, with a domestic state-controlled network in its place. The framing from ARTICLE 19 and Iranian analysts is precise — the project transforms internet access "from a civic right and development tool into a luxury, security-controlled commodity." The blackout did not interrupt that project. The blackout advanced it.
The supply chain is itself a surveillance surface. China's National Intelligence Law of 2017, Article 7, requires Chinese companies to cooperate with state intelligence operations on request. Hardware that inspects every packet at the network layer, sourced from companies under that legal obligation, is not only a censorship tool for the importing state — it is a potential intelligence-collection relationship for the exporting one. ARTICLE 19 has documented this as "China's infrastructure of oppression" in Iran.
The firewall is a product
The objection to all of this is that Iran is a special case — a state at war, under sanctions, with a particular regime, and therefore not a pattern that generalizes.
The hardware is the reason it generalizes.
The Great Firewall is not only China's domestic system. It is an explicit export model. DPI hardware is a product line, sold and shipped; the same supply chain that equipped Iran can equip any buyer. RFE/RL's reporting on the Sarafraz disclosure and ARTICLE 19's documentation of Chinese censorship infrastructure abroad describe a transferable architecture, not a one-off. Iran is not the exception to the rule. Iran is the demonstration unit.
The architecture generalizes precisely because the hardware does. A state does not need to develop a Great Firewall over fifteen years, as China did. It can buy the capability, install it, and — as Iran has now demonstrated — run an 88-day national test of the off-switch while the precision throttle is wired in behind it.
Who buys next is a genuine question, and not one the available reporting answers. What the reporting does establish is that the capability is a product, the product has at least one new operator at national scale, and the operator ran the longest internet shutdown in recorded history as part of bringing it online.
The counter is a protocol
The counter to Deep Packet Inspection is not a policy. It is a protocol property.
DPI-resistant transports are designed to defeat exactly the mechanism Iran is deploying. They work — they are how millions of people inside China reach the global internet through the Great Firewall every day — and their mechanisms are matched to the threat:
VLESS + Reality borrows the TLS handshake of a real, unrelated website so that to a DPI box the connection is indistinguishable from ordinary HTTPS traffic to that site; there is no distinct fingerprint to block.
Shadowsocks-2022 produces a traffic stream with no recognizable protocol signature — to DPI it looks like random bytes, with no header or handshake to match a blocklist against.
Trojan mimics standard HTTPS closely enough that blocking it means blocking HTTPS.
obfs4 wraps traffic in a pluggable-transport obfuscation layer that removes the statistical signature a classifier would key on.
The URnetwork peer-to-peer overlay distributes transport across a mesh of participants rather than a fixed set of blockable endpoints; there is no public-service operator registry for a DPI box to consult.
These are established protocol properties, designed and field-tested against the Great Firewall. The point is not in dispute: DPI can be defeated. That is exactly why Iran's restoration matters as a warning rather than a reassurance.
Because the defeat has a precondition.
You cannot install it after
The sharpest operational fact about circumvention is that you cannot acquire it after the throttle drops.
DPI-resistant transports are software. Software is distributed over the network. When the network is throttled — when app stores are blocked, when the download servers are unreachable, when the configuration that points a client at a working bridge cannot be fetched — the acquisition window has already closed. The tools to get around the throttle are on the far side of the throttle.
The 88 days proved this in the field. The people inside Iran who kept access through the blackout were, overwhelmingly, the people who had pre-positioned: who had Starlink terminals already on the roof, mesh apps like Briar already installed and paired, VPN and pluggable-transport configurations already loaded and tested before the connectivity dropped. The ones who waited until they needed circumvention to go looking for it found the search itself blocked.
This is the operational conclusion the permanent-DPI phase forces. Pre-positioning is no longer a precaution for a hypothetical emergency. With Chinese DPI hardware in place for a permanent throttle, pre-positioning is a standing requirement. The circumvention stack has to be installed, configured, and exercised while the network is open, because the next contraction may not have an 88-day end date.
The user-side primitive stack is not a thing you reach for when the throttle drops. It is a thing you live inside before it does.
Fifteen days
The American clock ran in parallel this week, and it is not Iran's clock.
Section 702 of the Foreign Intelligence Surveillance Act sunsets June 12 — fifteen days from today. The Senate returns from Memorial Day recess Monday June 1 or Tuesday June 2. The Foreign Intelligence Surveillance Court's March 17 opinion remains classified. The Office of the Director of National Intelligence said May 21 that Director Tulsi Gabbard is "working diligently to declassify"; no date has been committed.
The escalation in the reporting is worth stating precisely, with the caveat it requires. Per reporting on the still-classified FISC opinion, the court found that even after the Department of Justice shut down a filtering tool the FBI used in 2024, the FBI has been using another similar filtering tool to conduct queries without following requirements — and, per the same reporting, the NSA and CIA are using similar tools to search Section 702 data for Americans' communications. This is reporting on a classified document, not an adjudicated public finding; "with DOJ's blessing" is the reporting's characterization. If accurate, it widens the concern from one bureau's query practices to an intelligence-community-wide pattern.
The comparison to Iran's filternet has to be made carefully, because the two are not equivalent and saying so plainly is the only honest framing. The United States has warrant law, an adversarial court that wrote the opinion at issue, congressional oversight that negotiated its declassification, and a free press reporting on the classified document — none of which Iran's filternet has. The shared thread is not the rights context, which differs entirely. The shared thread is the architectural direction: toward more intermediary control. In the US column it is the state querying communications data it already holds. In the Iran column it is the state inspecting communications traffic at the network layer. Different mechanisms, different legal universes, one direction.
The §702 fight over the next fifteen days will be held on a program whose recent court ruling Congress still cannot see.
A USB drive in your office
The week's sharpest cyber story is the one where social engineering walked through the front door.
The FBI issued a FLASH alert (TLP:Clear) on May 26-27 warning that the Silent Ransom Group — also tracked as Luna Moth, Chatty Spider, and UNC3753, a criminal extortion crew active since 2022, not a nation-state actor — is targeting law firms with in-person office visits. The attack chain starts conventionally: a phishing email directs the target to call fake IT support; the callback pressures an employee into opening a remote desktop session. But when that fails, the group escalates physically. An operative shows up at the office posing as IT, claims to need to back up or image a system because of "possible issues" linked to the phishing email, and inserts a USB storage device into the computer.
No malware delivered over the network. No alert. A person and a USB drive. More than 38 firms are already on the group's public leak site; researchers estimate over 100 total attacks, surging in early 2026.
It is the offensive rhyme of the Iran lesson. The defensive lesson of the blackout is that the carrier-independent layer — the stuff that does not route through the controlled network — is what survives. The offensive version is that the attacker who bypasses the network bypasses the network's controls. An adversary who walks a USB drive past the firewall has defeated the firewall, exactly as a defender who pre-positions a Starlink terminal has defeated the blackout. The network is not the whole perimeter, for either side.
The rest of the week's cyber column fills out the same pattern of centralized-custodian exposure. Carnival confirmed a breach affecting nearly 6 million people — another large dataset held by a single custodian, lost at once. A Gitea container-image vulnerability disclosed May 28 allowed attackers to pull private container images, exposing source code, credentials, and infrastructure — a reminder that the self-hosted layer carries its own discipline burden; control comes with responsibility. An account-takeover vulnerability in the open-source conference tool Pretalx was disclosed the same day. And the Microsoft Exchange OWA CVE-2026-42897 FCEB remediation deadline arrives tomorrow, May 29 — day 14 of active exploitation, still no permanent patch, mitigation only.
The layers and the pipeline
The recipient-country layer this week shows one captured primitive at every level of the stack.
Mexico — 33 days to the CURP Biométrica deadline of June 30, when approximately 127 million unregistered mobile lines face suspension. Registration remains below 10 percent. The captured layer is the identity registry.
Niger — day 20 of the nine-international-media ban; Burkina Faso — day 23 of the TV5 Monde permanent ban. The captured layer is the broadcaster.
Hong Kong — the National Security Law is operationalizing coerced decryption against individuals. The captured layer is the device, at the moment of lawful-process compulsion. This is where end-to-end encryption reaches its limit and must be stated honestly: E2EE protects a message from platform disclosure, but it does not protect a phone that its owner has been legally compelled to unlock. The device-layer counter to a coerced endpoint is not encryption alone — it is a hardened operating system (GrapheneOS, CalyxOS) plus operational security plus, where the law allows, plausible compartmentalization. The protocol does not absolve the operator.
Against each captured layer, the protocol pipeline ships a counter, and it shipped this week regardless of any state's calendar:
- Financial layer: Monero FCMP++ closed its Trail of Bits audit May 22 (report 2-6 weeks out, mainnet targeted H2 2026); Zcash NU7 launched its testnet the same day.
- Communications layer: Discord DAVE end-to-end encryption continues rolling out to ~200 million monthly active users; Signal's Sparse Post-Quantum Ratchet continues iterating.
- Anonymous-network layer: Tor Browser 15.0.14 shipped May 19 with a ten-project crowdfunding round; the URnetwork overlay runs the DPI-resistant transport layer.
- Device layer: GrapheneOS 2026050900 and CalyxOS 7.2.1.0 remain the current hardened baselines.
One captured primitive at every layer; one user-side counter at every layer.
The stack that carried through
The honest accounting of the user-side primitive stack has to include its costs, and this week supplied them.
It depends on institutions: Tor's development is substantially grant-funded (Open Technology Fund, State Department); Monero's audit ran through Trail of Bits and the MAGIC Monero Fund; Zcash's upgrade runs through Shielded Labs. The pipeline is not autonomous from institutional input. The claim this series makes is narrower and survives the concession: the pipeline does not compress around any single state's calendar, and the primitives, once shipped, run on the user's device regardless of the intermediary.
It is unevenly accessible: the people who kept connectivity through the Iran blackout were the people who already had Starlink terminals and pre-configured tools — which is not everyone, and the inequality is real. And it carries its own discipline burden: the Gitea vulnerability is the reminder that self-hosting and user control come with responsibility, that the stack rewards practiced primitives and punishes careless ones. It is not magic. It is a set of tools that demand competence.
And with all of that conceded, here is what the week established: the user-side primitive stack is the layer that carried through 88 days of total carrier control. When the state cut the network for 90 million people for the longest stretch in recorded history, the people who stayed connected stayed connected through Starlink, through mesh, through pre-positioned circumvention — through the parts of the stack that do not route through the controlled intermediary. That is the strongest single proof this publication has documented in the run of these editions. The longest shutdown in modern history could not fully reach the carrier-independent layer.
Eighty-eight days proved the off-switch works and built the throttle that comes after. The Chinese DPI hardware is in place. The restoration is 40 percent into a filternet that never turned off. Restoration is not return.
The architecture was the point.
So is the counter — and it has to be standing before the next contraction, because the tools to get around the throttle live on the far side of the throttle.
Eighty-eight days.
The switch stays. Pre-position the stack.
URnetwork is a peer-to-peer overlay for censorship-resistant transport, designed to resist network-layer Deep Packet Inspection. The February 19, 2026 MCP server release lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer. URnetwork does not appear in the public-service operator registry of any of the statutes or systems named in this article.
https://ur.io